diff --git a/simple-mind-map/src/utils/index.js b/simple-mind-map/src/utils/index.js
index 228516d1..8541ff93 100644
--- a/simple-mind-map/src/utils/index.js
+++ b/simple-mind-map/src/utils/index.js
@@ -629,7 +629,7 @@ export const textToNodeRichTextWithWrap = html => {
   }
   return list
     .map(item => {
-      return `<p><span>${item}</span></p>`
+      return `<p><span>${htmlEscape(item)}</span></p>`
     })
     .join('')
 }
diff --git a/web/src/pages/Edit/components/Outline.vue b/web/src/pages/Edit/components/Outline.vue
index 234d60ef..c6ba3b30 100644
--- a/web/src/pages/Edit/components/Outline.vue
+++ b/web/src/pages/Edit/components/Outline.vue
@@ -42,7 +42,8 @@ import {
   nodeRichTextToTextWithWrap,
   textToNodeRichTextWithWrap,
   getTextFromHtml,
-  createUid
+  createUid,
+  htmlEscape
 } from 'simple-mind-map/src/utils'
 
 // 大纲树
@@ -129,10 +130,11 @@ export default {
       let data = this.mindMap.getData()
       data.root = true // 标记根节点
       let walk = root => {
-        const text = (root.data.richText
+        let text = (root.data.richText
           ? nodeRichTextToTextWithWrap(root.data.text)
           : root.data.text
         ).replaceAll(/\n/g, '<br>')
+        text = htmlEscape(text)
         root.textCache = text // 保存一份修改前的数据，用于对比是否修改了
         root.label = text
         root.uid = root.data.uid
diff --git a/web/src/pages/Edit/components/OutlineEdit.vue b/web/src/pages/Edit/components/OutlineEdit.vue
index 2a8e5bac..aea3eea2 100644
--- a/web/src/pages/Edit/components/OutlineEdit.vue
+++ b/web/src/pages/Edit/components/OutlineEdit.vue
@@ -54,7 +54,8 @@ import {
   textToNodeRichTextWithWrap,
   getTextFromHtml,
   createUid,
-  simpleDeepClone
+  simpleDeepClone,
+  htmlEscape
 } from 'simple-mind-map/src/utils'
 import { storeData } from '@/api'
 
@@ -102,10 +103,11 @@ export default {
       let data = this.mindMap.getData()
       data.root = true // 标记根节点
       let walk = root => {
-        const text = (root.data.richText
+        let text = (root.data.richText
           ? nodeRichTextToTextWithWrap(root.data.text)
           : root.data.text
         ).replaceAll(/\n/g, '<br>')
+        text = htmlEscape(text)
         root.textCache = text // 保存一份修改前的数据，用于对比是否修改了
         root.label = text
         root.uid = root.data.uid